Trivi config scanning - incorrect code lines and files in report

[ngnix]

Description

What did you expect to happen?

See the lines in the file where the problem is found

What happened instead?

The problem is in one file - the description indicates another file and its lines

Output of run with -debug:

/tmp/app # trivy config --debug . 
2023-03-06T10:45:04.618Z        DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-03-06T10:45:04.620Z        DEBUG   cache dir:  /root/.cache/trivy
2023-03-06T10:45:04.620Z        INFO    Misconfiguration scanning is enabled
2023-03-06T10:45:04.620Z        DEBUG   Failed to open the policy metadata: open /root/.cache/trivy/policy/metadata.json: no such file or directory
2023-03-06T10:45:04.620Z        INFO    Need to update the built-in policies
2023-03-06T10:45:04.620Z        INFO    Downloading the built-in policies...
39.14 KiB / 39.14 KiB [-------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 0s
2023-03-06T10:45:06.387Z        DEBUG   Digest of the built-in policies: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd
2023-03-06T10:45:06.387Z        DEBUG   Policies successfully loaded from disk
2023-03-06T10:45:06.387Z        DEBUG   Walk the file tree rooted at '.' in parallel
2023-03-06T10:45:07.649Z        DEBUG   OS is not detected.
2023-03-06T10:45:07.649Z        INFO    Detected config files: 5
2023-03-06T10:45:07.649Z        DEBUG   Scanned config file: templates/clusterrolebinding.yaml
2023-03-06T10:45:07.649Z        DEBUG   Scanned config file: templates/role.yaml
2023-03-06T10:45:07.649Z        DEBUG   Scanned config file: templates/rolebinding.yaml
2023-03-06T10:45:07.649Z        DEBUG   Scanned config file: templates/serviceaccount.yaml
2023-03-06T10:45:07.649Z        DEBUG   Scanned config file: templates/vault.yaml

templates/role.yaml (helm)

Tests: 144 (SUCCESSES: 139, FAILURES: 5, EXCEPTIONS: 0)
Failures: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 5)

CRITICAL: Role permits management of secret(s)
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Check whether role permits managing secrets

See https://avd.aquasec.com/misconfig/ksv041
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 templates/role.yaml:13-20
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  13 ┌   image: "vault:1.12.3"
  14 │   size: 1
  15 │   bankVaultsImage: "ghcr.io/banzaicloud/bank-vaults:1.19.0"
  16 │   statsdImage: "prom/statsd-exporter:v0.23.0"
  17 │ 
  18 │   # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running
  19 │   serviceAccount: vault
  20 └ 
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


CRITICAL: Role permits management of secret(s)
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Check whether role permits managing secrets

See https://avd.aquasec.com/misconfig/ksv041
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 templates/role.yaml:21-28
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  21 ┌   # Specify the Service's type where the Vault Service is exposed
  22 │   # Please note that some Ingress controllers like https://github.com/kubernetes/ingress-gce
  23 │   # forces you to expose your Service on a NodePort
  24 │   serviceType: ClusterIP
  25 │ 
  26 │   
  27 │ 
  28 └   resources:
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Output of trivy -v:

/tmp/app # trivy -v 
Version: 0.38.1
Policy Bundle:
  Digest: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd
  DownloadedAt: 2023-03-06 10:45:06.38740671 +0000 UTC

Additional details (base image name, container registry info...):

My file role.yaml from template folder:

{{- if .Values.rbac.create -}}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "vault.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "vault.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - bank-vaults
    verbs:
      - "*"
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - {{ include "vault.fullname" . }}-unseal-keys
    verbs:
      - "*"
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - ""
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - update
      - patch
{{- end }}

As you can see in the hint window, lines 13 to 20 are listed - but their content is taken from another file!

[ngnix]

Hey guys, do you have any update?

[simar7]

hi would you be able to share the template and the values both so we can try to reproduce this issue?

Or if you can give a smaller example that we can use to reproduce the issue, it will help.